Re: [Ntp] Quick review of WGLC for status change for draft-ietf-ntp-update-registries

[Heiko Gerstung <[e-mail]>]

Hi Miroslav,

OK, maybe we should not redefine this for V5 then - although I would expect that not too many implementations are using mode 7 packets anyway.

One situation we have to take care of IMHO is an NTPv2/v3/v4 client trying to use a V5 server. Maybe it would be better to just state that a V5 only implementation must not respond to V2,V3,V4 requests. If it chooses to support those older protocol versions, it has to respond with the correct (requested) packet format. 

The second problem is an NTP V5 client sending a request to a V2/V3/V4 server. It would be possible to send a V5 NTP request in a V4 compatible format here (as a probe) and if we receive a response indicating that V5 is not supported (as far as I understood, ntpd would for example send a V4 response, others might choose not to respond at all), we can go away and look for a V5 supporting server. 

I would not have too many concerns regarding the firewalls, as a lot of them are not using this kind of deep packet inspection approach to blocking NTP traffic (and those who do would probably be the better maintained ones where there is at least reason for hope that the configuration will be adjusted to look at both NTP VN and Mode). Firewalls might be a problem anyway, as they tend to look at NTP packet lengths and therefore might end up blocking V5 traffic if we manage to increase the packet size to exceed the firewall's limit for an NTP packet). 

Regards,
  Heiko



--
Heiko Gerstung | Managing Director
T: [phone] | LinkedIn Profile <https://www.linkedin.com/in/heikogerstung/> | Twitter <https://twitter.com/hgerstung>
[e-mail]

MEINBERG® The Synchronization Experts
 
Meinberg Funkuhren GmbH & Co. KG
Lange Wand 9 | 31812 Bad Pyrmont | Germany
Web: http://www.meinberg.de | http://www.meinbergglobal.com | LinkedIn  <https://www.linkedin.com/company/meinberg-funkuhren-gmbh-&-co--kg>

Amtsgericht Hannover 17HRA 100322
Geschäftsführer/Management: Günter Meinberg, Werner Meinberg, Andre Hartmann, Heiko Gerstung

Do not miss our Time Synchronization Blog:
http://blog.meinbergglobal.com
 
 

Am 15.08.22, 13:03 schrieb "ntp im Auftrag von Miroslav Lichvar" <[e-mail] im Auftrag von [e-mail]>:

    On Mon, Aug 15, 2022 at 12:58:17PM +0200, Heiko Gerstung wrote:
    > thanks for the quick response. As far as I can see, mode 7 is "reserved" in the current version of the RFC for NTP, or did I miss an errata?

    The RFC says "reserved for private use".

    Another thing to consider is that mode 7 might be blocked in firewalls
    for all NTP versions to prevent amplification attacks exploiting the
    ntpd private protocol (aka ntpdc).

    -- 
    Miroslav Lichvar

    _______________________________________________
    ntp mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/ntp